10:03 PM 10/6/200309-06-2003 -- 1.2.0 ----------------------------------------- 1. Implemented secure authentication from console to server via MD5 challenge/response. For more details on this mechanism, see the soon to be released technical information on the IDEA project web page. Also, the syntax of the ServerUsers.cfg file has been changed. See the IDEA-1.2 install instructions for more information on this syntax. 2. Implemented interfaces to improve modularity. 3. Improved client/server error messages. 4. Enhanced web application functionality - links to CVE, BugTraq, other information sources. 5. Fixed bugs in SensorMap (failed to update alert count after alert deletion), and QueryFactory (after extended time period, database connection is closed, causing errors if a Query is attempted). 6. Got IDEA working with Snort 2.0. For best results use Snort >= 2.0.2. Bugs in 2.0.0 and 2.0.1 prevent IDEA query capability from working properly. For more info on getting IDEA working with Snort 2.0, see the installation HOWTO document. 7. Fixed input validation bug in QueryBuilder. Should work better now for all input. 03-22-2003 -- 1.1.0 ----------------------------------------- 1. Numerous internal changes / bugfixes / code cleanups 2. Modularized the code so that it should be much easier to write plugins / modules to work with the IDEA console and server 3. Implemented observer interfaces for the AlertList, HotIPList, and SensorList. Any java class that implements the interface will receive notifications as to when there are changes made to the lists. 4. Implemented the initial code to do user authentication on the IDEA server. This is still not 100% implemented, but once I get the syntax figured out for the password file, it should be easy. Don't be surprised if your username appears as System in the chat window. 5. Fixed a bunch of the database code so it should be much more modular now. The code should work with any database. 6. Segregated code for the Menu bar from the code for the console. 02-22-2003 -- 1.0.2 ----------------------------------------- 1. Added a triangle icon to the AlertsTable to show the sort column and the sort direction (ascending or descending). This is for situational awareness. 2. Fixed bug in column sort where the IP addresses were sorted backwards (i.e. ascending was actually descending and vice-versa) 3. PostgreSQL capability! IDEA console now works with Postgres databases (tested with Postgres version 7.2) 4. Several ease-of-use enhancements to the IDEA web application. 5. Added the ability to specify the date and now also the time on the report generator. This should provide additional flexibility when generating statistics / reports. 6. The IDEA server can now bind to ports other that 1051. Use the -p switch to specify an alternate port. 1051 is the default if no port is specified. 7. Changed several classes in the IDEA-server to be more secure. Added thread-safe methods for assigning Collection ID #s to alerts. Made variables private and added accessor and mutator methods for accessing the variables. 8. Added timestamps to all IDEA server logfile messages. 9. Added javadoc comments to as many methods / variables as possible. 02-07-2003 -- 1.0.1 ----------------------------------------- 1. Fixed querybuilder bug -- error retrieving ICMP alerts from database. 2. Added code to persist the size and location of the window when the console is closed. This way, when you start it back up, it will start up at the same spot and size as when you closed it. 3. Added the ability to select more colors for Hot IPs and sensors than just the standard eight by using a color chooser. 4. The settings panel is now "DB aware" -- i.e. it doesn't automatically assume that DB type is MySQL. This is the first step towards compatibility with other databases. This is step number one to supporting other databases. 5. Added the ability to remove alerts from the RTA server. Discard the false alarms and/or extraneous data that you don't want on the server by clicking on "File->RTA Server->Remove" and then selecting the appropriate menu item. 6. Fixed bug in the IDEA server so that it is more thread safe. Previously, it was possible for two alerts that arrive very close together to be assigned the same alert ID. This should no longer happen. 7. Added the ability for the server to log to a file. This is helpful for debugging server errors and just keeping track of who is doing what with your server. 1-16-2003 -- 1.0 ----------------------------------------- 1. Initial release